Loading HuntDB...

Users able to set video url for unpublished words and able to see the name of unpublished words

Low
U
Urban Dictionary
Submitted None
Reported by d3f4u17

Vulnerability Details

Technical details and impact analysis

Information Disclosure
**Summary** Users will be able to set youtube video URL to unpublished words and will be able to see names of an unpublished word. **Description** Once a user publishes a word and later unpublish it, others user still would be able to set the youtube video URL for it and will be able to see the name of the unpublished words. ##Steps to reproduce 1. Go to your account and create a new definition and see the URL to get the definition_id. 2. Go to definitions page and unpublish it. 3. Now visit the following URL [https://www.urbandictionary.com/video.new.php?defid=your_def_id](https://www.urbandictionary.com/video.new.php?defid=your_def_id) 4. Now you will be able to set the youtube video URL and will be able to see the name of the unpublished word. In my case i have used the following **defid** *12504202* * To check whether the word is unpublished or not I used the urbandictionary's api and used the following URL [http://api.urbandictionary.com/v0/define?defid=12504202](http://api.urbandictionary.com/v0/define?defid=12504202) and it returned me an empty list, showing that no data exists for the given defid. >see poc-1 * Then I passed the samedefid to the URL defined at step 3 [https://www.urbandictionary.com/video.new.php?defid=12504202](https://www.urbandictionary.com/video.new.php?defid=12504202) and after visiting it I was able to see the name and was able to set the youtube video for it. >see poc-2 ##POC/Screenshots * POC-1 {F413241} * POC-2 {F413242} ## Impact * Information disclosure

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Submitted

Weakness

Information Disclosure